CVE-2026-35662: OpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-10 · updated 2026-06-17
Weakness: CWE-862

Description

OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope. Attackers can exploit this by using the send action to communicate with child sessions without proper scope validation, bypassing intended access control restrictions.

Affected products

OpenClaw: before 2026.3.22 — fixed in 2026.3.22

How to fix

Upgrade to a fixed version: OpenClaw 2026.3.22. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87
https://github.com/openclaw/openclaw/commit/7679eb375294941b02214c234aff3948796969d0
https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w
https://www.vulncheck.com/advisories/openclaw-missing-controlscope-enforcement-in-send-action

Get alerted when CVE-2026-35662 or the next vulnerability affects your stack